The Timetics WordPress plugin prior to version 1.0.52 lacks authorization checks on a REST endpoint, allowing any user—including unauthenticated visitors—to arbitrarily change the payment status and post status of "timetics-booking" custom posts. This results in the unauthorized alteration of booking records, potentially marking unpaid reservations as paid, enabling fraudulent claims, or disrupting inventory and financial reporting. The weakness is categorized as CWE‑862, reflecting an improper authorization flaw.

Vulnerable systems include any WordPress site running the Timetics plugin at a version older than 1.0.52. The affected version information is explicitly cited: "before 1.0.52". Sites using newer releases are not impacted.

The CVSS score of 4.3 indicates moderate severity, with an EPSS score of less than 1% suggesting a low likelihood of exploit. It is not listed in the CISA KEV catalog. The likely attack vector inferred from the description is a remote unauthenticated request to the plugin’s REST endpoint.